An online gaming platform's architecture review reveals significant technical debt accumulated during rapid initial scaling on Google Cloud. The audit identifies two major operational and security risks: engineering teams maintain infrastructure using unversioned local Terraform state files stored on developer laptops, and backend service accounts have been granted the primitive Owner role across all GCP projects to simplify component interaction. Which TWO actions should you take to mitigate this technical debt and align with GCP architectural best practices?
- Migrate Terraform state management to a centralized Cloud Storage backend with object versioning and state locking enabled.Answer
- Audit service account usage and replace primitive Owner roles with least-privilege predefined or custom IAM roles.Answer
- CCommit local Terraform state files directly into the central application Git repository to synchronize state across developer environments.
- DAssign the Service Account Admin role to all compute instances so services can dynamically grant themselves required access rights.
Answer
To mitigate technical debt, configure a centralized Cloud Storage backend with object versioning and state locking for Terraform state management, and audit service accounts to replace primitive roles with targeted predefined or custom IAM roles.
Configuring remote Cloud Storage state backends with object versioning and state locking eliminates state drift and concurrency risks. Replacing broad primitive Owner roles on service accounts with targeted predefined or custom roles re-establishes governance and least-privilege security controls.
Step-by-Step Solution
Key Concept
Mitigating technical debt by modernizing IaC state persistence and remediating over-privileged IAM access.
Estimated Time:1m 30s